barkstack/barkstack
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: allow TLS-less Barkfile initialization

Browse Source
This commit is contained in:
Shaun Campbell
2026-09-15 22:03:58 -04:00
parent a51207e8df
commit 9f72ef3842
4 changed files with 47 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
go.mod
View File

@@ -2,4 +2,4 @@ module cloud.campbellwireless.net/git/barkstack/barkstack
go 1.24
require cloud.campbellwireless.net/git/barkstack/barkfile-parser v1.0.0
require cloud.campbellwireless.net/git/barkstack/barkfile-parser v1.1.0

4
go.sum
View File

@@ -1,2 +1,2 @@
cloud.campbellwireless.net/git/barkstack/barkfile-parser v1.0.0 h1:81V2fr9ln2WNqA2JHb40fvav0aW+5OQAOsnuhMkuRes=
cloud.campbellwireless.net/git/barkstack/barkfile-parser v1.0.0/go.mod h1:UnKTlB8ifO3cmsrkh2LDAM+Y2ipaCrBeiURwrSRPPe4=
cloud.campbellwireless.net/git/barkstack/barkfile-parser v1.1.0 h1:ULdpvY1VC1d5M8VHx8SqacVLmk5SgvDYABDuzewebjc=
cloud.campbellwireless.net/git/barkstack/barkfile-parser v1.1.0/go.mod h1:UnKTlB8ifO3cmsrkh2LDAM+Y2ipaCrBeiURwrSRPPe4=

25
internal/swarm/swarm.go
View File

@@ -69,13 +69,16 @@ func (p Provisioner) Init(ctx context.Context, options Options) error {
if err != nil {
return err
}
certificatePath, err := existingPath(config.TLS.CertFile, filepath.Dir(configPath))
if err != nil {
return fmt.Errorf("TLS certificate: %w", err)
}
keyPath, err := existingPath(config.TLS.KeyFile, filepath.Dir(configPath))
if err != nil {
return fmt.Errorf("TLS private key: %w", err)
certificatePath, keyPath := "", ""
if config.TLS.CertFile != "" || config.TLS.KeyFile != "" {
certificatePath, err = existingPath(config.TLS.CertFile, filepath.Dir(configPath))
if err != nil {
return fmt.Errorf("TLS certificate: %w", err)
}
keyPath, err = existingPath(config.TLS.KeyFile, filepath.Dir(configPath))
if err != nil {
return fmt.Errorf("TLS private key: %w", err)
}
}
socketPath, err := existingPath(options.DockerSocketPath, "")
@@ -212,11 +215,13 @@ func (p Provisioner) ensurePawSQL(ctx context.Context, options Options, barkfile
"--network", options.NetworkName,
"--publish", "published=5432,target=5432,mode=ingress",
"--mount", bindMount(barkfilePath, serviceConfigPath),
"--mount", bindMount(certificatePath, certificatePath),
"--mount", writableBindMount(socketPath, DefaultDockerSocket),
}
if keyPath != certificatePath {
args = append(args, "--mount", bindMount(keyPath, keyPath))
if certificatePath != "" {
args = append(args, "--mount", bindMount(certificatePath, certificatePath))
if keyPath != certificatePath {
args = append(args, "--mount", bindMount(keyPath, keyPath))
}
}
args = append(args, options.PawSQLImage, "--config", serviceConfigPath)
if _, err := p.Runner.Run(ctx, args...); err != nil {

29
internal/swarm/swarm_test.go
View File

@@ -68,6 +68,35 @@ func TestInitUpdatesExistingPawSQLService(t *testing.T) {
}
}
func TestInitSkipsTLSMountsWithoutTLSConfigured(t *testing.T) {
paths := writeBarkfile(t)
directory := filepath.Dir(paths.barkfile)
plaintext := filepath.Join(directory, "Barkfile-plaintext")
contents := "pawsql {\n listen :5432\n database app {\n upstream 127.0.0.1:5432\n }\n}\n"
if err := os.WriteFile(plaintext, []byte(contents), 0o600); err != nil {
t.Fatal(err)
}
runner := &fakeRunner{responses: []response{
{output: "active true"},
{},
{},
{err: errors.New("service barkstack-pawsql not found")},
{},
}}
if err := (Provisioner{Runner: runner}).Init(context.Background(), Options{BarkfilePath: plaintext, DockerSocketPath: paths.socket}); err != nil {
t.Fatal(err)
}
service := runner.callContaining(t, "service create")
for _, forbidden := range []string{"cert.pem", "key.pem"} {
if strings.Contains(service, forbidden) {
t.Errorf("service create = %q, unexpectedly mounts %q", service, forbidden)
}
}
if !strings.Contains(service, writableBindMount(paths.socket, DefaultDockerSocket)) {
t.Errorf("service create = %q, missing Docker socket mount", service)
}
}
func TestInitAddsMissingDockerSocketToExistingService(t *testing.T) {
paths := writeBarkfile(t)
runner := &fakeRunner{responses: []response{